Maine Act to Protect Privacy of Online Consumer Information

On June 7, 2019, Maine Gov. Janet Mills signed into law the Act to Protect the Privacy of Online Consumer Information, which prohibits broadband Internet access service providers from using, selling, distributing or permitting access to customer personal information for purposes other than providing services, unless the customer expressly consents to that use, disclosure, sale, or access. The new law, which applies only to broadband providers operating within Maine when providing services to individuals physically located in Maine, becomes effective as of July 1, 2020.

The term “customer personal information” includes two types of information: (a) “personally identifiable customer information” about the customer and (b) information derived from the customer’s use of broadband internet access services, which includes a wide range of information, for instance, web browsing history, application usage history, geolocation, financial and health information, device identifier, IP address, and the content of the customer’s communications.

There are several exceptions to the general prohibition, where the use, sale, disclosure, or sharing of personal information is permitted without prior express, affirmative consent. Those range from information necessary to provide the service to handling emergencies, collecting payment, or protection against fraud.

The new statute also requires the service provider to take reasonable security measures to protect the personal information from unauthorized use, disclosure, or access, and to provide clear and conspicuous notice of the customer’s right.

Since the passage of the California Consumer Privacy Act (Cal. Civ. Code §1798.100 et seq.) several states have evaluated adoption of bills that would allow consumers to object to the sale of their personal information. While a dozen states are in the early stages of this process, Nevada amended its existing consumer privacy statute in May (see GT Alert, Nevada Passes Opt-out Privacy Law, Effective October 1, 2019) to grant consumers a right to opt out of the sale of their personal information.

There are significant differences between the Maine law and those of California and Nevada. For example, both California and Nevada provide for an opt-out right (in most instances), while Maine requires a more restrictive opt-in (with limited exceptions). The range of protected information is very wide in Maine and California, but limited in Nevada. The Maine law is very short and does not provide much detail on how to implement its provisions; the California law is lengthy and detailed.

With three states having adopted statutes that restrict or prohibit the sale, disclosure, or sharing of personal information, in three different ways, with three different definitions of the types of information to be protected and the categories of entities affected, businesses are facing increasing compliance burdens. In the meantime, while interest in the creation of a…